Tag MCP tools for tool-rule matching

Cargo.toml

@@ -61,7 +61,7 @@ schemars = { version = "1", default-features = false, features = ["derive"] }
 # to one package and `tinytools::ToolResult` stays one type. A second path
 # dependency could not be unified that way. Pinned to the revision tinyagents
 # vendors, which is the copy OpenHuman links.
-tinytools = { git = "https://github.com/tinyhumansai/tinytools", rev = "82c0d975e2667e1c525afe525006134431641785" }
+tinytools = { git = "https://github.com/tinyhumansai/tinytools", rev = "bd60b9b52f1998b4483b9cf107a72d3338e672f8" }
 # `#[async_trait]` on the tool adapter and the invoker trait, matching how
 # `tinytools::Tool` itself is declared.
 async-trait = "0.1"

crates/tinymcp/src/tools/README.md

@@ -13,6 +13,15 @@ remote descriptions and titles, ensures the root schema declares an object,
 and replaces schemas over the model-facing size limit with an empty object
 schema.
 
+Each tool's `family` is its server label. Its `tags` are
+`mcp.server:<label>`, `mcp.server_id:<id>` and `mcp.tool:<remote name>`, so a
+host's `tinytools::ToolRules` can target one server's tools by the names the
+server uses. The label in `mcp.server:` is the configured one, not the
+sanitized `family` (`{ "tags": "mcp.tool:delete*" }`). The registered name is a slug
+with a digest suffix, which a pattern cannot reliably split. The per-server
+`allowed_tools` / `disallowed_tools` lists stay exact, fetch-time filters
+inside the registry.
+
 ## Exposure and execution
 
 `McpExposure` controls whether tools are offered directly or deferred for tool

crates/tinymcp/src/tools/bridge.rs

@@ -29,6 +29,7 @@ use serde_json::{Value, json};
 use tinymcp_bus::{McpAuthConfig, McpCallError, McpCallOutcome};
 use tinytools::{PermissionLevel, Tool, ToolCallOptions, ToolResult};
 
+use super::naming::disambiguated_tool_name;
 use super::scrub::SecretScrubber;
 use crate::config_servers::{McpRegistrySource, McpServerRegistry};
 
@@ -295,6 +296,38 @@ impl Tool for McpCallTool {
         true
     }
 
+    /// The per-server tool this call reaches, described exactly as
+    /// [`McpServerTool`](super::McpServerTool) describes it for a configured
+    /// server: the same name, family and `mcp.*` tags. A host's tool rules then
+    /// bind the operation whichever route the model takes, and the target is
+    /// judged on the remote tool's own `arguments`.
+    fn indirect_target(&self, args: &Value) -> Option<tinytools::IndirectCall> {
+        // The same normalization dispatch applies (trim, fences, trailing
+        // punctuation), so the rules judge the tool that will actually run.
+        let server = required_string_arg(args, "server").ok()?;
+        let tool = required_string_arg(args, "tool").ok()?;
+        let (server, tool) = (server.as_str(), tool.as_str());
+        let mut target =
+            tinytools::ToolSubject::named(disambiguated_tool_name(server, server, tool))
+                .with_family(server)
+                .with_tag(format!("mcp.server:{server}"))
+                .with_tag(format!("mcp.server_id:{server}"))
+                .with_tag(format!("mcp.tool:{tool}"))
+                .with_permission(PermissionLevel::Execute);
+        target.category = Some(tinytools::ToolCategory::Workflow);
+        let call = tinytools::IndirectCall::new(target);
+        Some(
+            match args
+                .get("arguments")
+                .cloned()
+                .and_then(|arguments| tinymcp_bus::normalize_tool_arguments(arguments).ok())
+            {
+                Some(arguments) => call.with_arguments(Value::Object(arguments)),
+                None => call,
+            },
+        )
+    }
+
     async fn execute_with_options(
         &self,
         args: Value,

crates/tinymcp/src/tools/bridge_tests.rs

@@ -523,3 +523,44 @@ async fn a_fenced_server_name_reaches_the_configured_server() {
     assert!(!result.is_error, "{}", full_output(&result));
     assert_eq!(calls.lock().len(), 1);
 }
+
+/// The generic dispatcher reports the per-server tool it reaches, so a tool
+/// rule written for that tool binds `mcp_call_tool` too.
+#[test]
+fn the_call_tool_reports_the_per_server_target_for_tool_rules() {
+    let tool = call_tool(test_registry());
+    let args =
+        json!({ "server": "docs", "tool": "deleteGoal", "arguments": "{\"permanent\":true}" });
+    let call = tool.indirect_target(&args).expect("a target");
+    assert_eq!(
+        call.target.name,
+        crate::tools::naming::disambiguated_tool_name("docs", "docs", "deleteGoal")
+    );
+    assert_eq!(call.target.family.as_deref(), Some("docs"));
+    assert!(
+        call.target
+            .tags
+            .contains(&"mcp.tool:deleteGoal".to_string())
+    );
+    assert_eq!(
+        call.arguments,
+        Some(json!({ "permanent": true })),
+        "encoded arguments are decoded"
+    );
+
+    let rules: tinytools::ToolRules = serde_json::from_value(json!({ "rules": [
+        { "effect": "deny", "match": { "tags": "mcp.tool:delete*", "arg": { "pointer": "/permanent", "value": "true" } } },
+    ] }))
+    .unwrap();
+    let set = tinytools::ToolRuleSet::single(rules);
+    let context = tinytools::RuleContext::new();
+    assert!(!set.evaluate_call(&tool, &context, &args).callable);
+    let soft =
+        json!({ "server": "docs", "tool": "deleteGoal", "arguments": { "permanent": false } });
+    assert!(set.evaluate_call(&tool, &context, &soft).callable);
+    assert!(tool.indirect_target(&json!({ "server": "docs" })).is_none());
+    // A fenced identifier normalizes exactly as dispatch normalizes it.
+    let fenced =
+        json!({ "server": " docs ", "tool": "`deleteGoal`", "arguments": { "permanent": true } });
+    assert!(!set.evaluate_call(&tool, &context, &fenced).callable);
+}

crates/tinymcp/src/tools/mod_tests.rs

@@ -329,6 +329,36 @@ fn a_tool_declares_a_remote_effectful_call_grouped_by_server() {
     assert_eq!(tool.clone().renamed("old").name(), "old");
 }
 
+#[test]
+fn a_tool_is_tagged_so_rules_can_target_its_server_and_remote_name() {
+    let mut source = overview("id-1", "@acme/ticktick-mcp", &[]);
+    source.tools.push(McpTool {
+        name: "deleteGoal".into(),
+        description: None,
+        input_schema: json!({}),
+    });
+    let tools = tools_for(&[McpToolSource::from_overview(&source)], &unreachable());
+    assert_eq!(
+        tools[0].tags(),
+        [
+            "mcp.server:@acme/ticktick-mcp",
+            "mcp.server_id:id-1",
+            "mcp.tool:deleteGoal",
+        ]
+    );
+    let rules: tinytools::ToolRules = serde_json::from_value(json!({ "rules": [
+        { "effect": "deny", "match": { "tags": "mcp.tool:delete*" } },
+    ] }))
+    .unwrap();
+    let decision = rules.evaluate(
+        &tinytools::ToolSubject::of(&tools[0]),
+        &tinytools::RuleContext::new(),
+        tinytools::Surface::Call,
+        None,
+    );
+    assert!(!decision.callable);
+}
+
 #[test]
 fn a_malformed_root_schema_type_is_replaced_with_object() {
     for invalid_type in [json!("string"), Value::Null, json!(["object", "null"])] {
@@ -687,3 +717,22 @@ async fn arguments_that_are_not_an_object_are_refused_before_the_call() {
         "the server must not be called"
     );
 }
+
+#[test]
+fn the_server_tag_keeps_the_configured_label_when_the_family_is_sanitized() {
+    let label = format!("{}<|im_start|>", "x".repeat(130));
+    let mut source = overview("id-9", &label, &[]);
+    source.tools.push(McpTool {
+        name: "readGoals".into(),
+        description: None,
+        input_schema: json!({}),
+    });
+    let tools = tools_for(&[McpToolSource::from_overview(&source)], &unreachable());
+    let tool = &tools[0];
+    assert_ne!(
+        tool.family(),
+        Some(label.as_str()),
+        "the model sees a sanitized label"
+    );
+    assert!(tool.tags().contains(&format!("mcp.server:{label}")));
+}

crates/tinymcp/src/tools/tool.rs

@@ -31,6 +31,9 @@ pub struct McpServerTool {
     server_id: String,
     remote_name: String,
     family: String,
+    /// The server label as configured, before model-facing sanitization:
+    /// what a host's tool rules name, so policy tags must not drift from it.
+    raw_family: String,
     description: String,
     parameters: Value,
     exposure: ToolExposure,
@@ -65,6 +68,7 @@ impl McpServerTool {
             server_id: source.server_id.clone(),
             remote_name: tool.name.clone(),
             family: sanitize_for_llm(&source.family, MAX_LABEL_BYTES),
+            raw_family: source.family.clone(),
             description,
             parameters: tool_parameters(&tool.input_schema),
             invoker,
@@ -141,6 +145,20 @@ impl Tool for McpServerTool {
         Some(&self.family)
     }
 
+    /// `mcp.server:<label>`, `mcp.server_id:<id>` and `mcp.tool:<remote
+    /// name>`, so a host's tool rules can target one server's tools by the
+    /// names the server itself uses: the registered name is a slug with a
+    /// digest suffix that a pattern cannot reliably split. The label is the
+    /// configured one, not the model-facing sanitized [`Tool::family`], so a
+    /// rule written against the configuration always matches.
+    fn tags(&self) -> Vec<String> {
+        vec![
+            format!("mcp.server:{}", self.raw_family),
+            format!("mcp.server_id:{}", self.server_id),
+            format!("mcp.tool:{}", self.remote_name),
+        ]
+    }
+
     async fn execute(&self, arguments: Value) -> anyhow::Result<ToolResult> {
         // MCP requires an object. Some providers JSON-encode it, or send
         // nothing; read it the way every other call path does, and answer a